I am doing a talk on how to role your own authorization framework. There is actually a
paper out on MSDN that addresses this same topic. However, the paper relies entirely on the .NET Framework. The are a number of possibilities and options and this talk will have additional content focused on those decision points. The abstract is below.
Designing Application Managed Authorization
There are several mechanisms for performing authorization available on the Windows platform. It’s important you understand what your options are. This session will walk through those options and then address how to design a reusable authorization application framework when those options don't meet application requirements. It will focus on common authorization tasks and scenarios, and provide you with guidelines on how to maximize security and performance. In addition it will demonstrate different approaches and techniques for application managed authorization.
The presentation is at the Microsoft office in Bloomington, you can get more information here.